インジェクションを防ぐため入力を検証する

Every value a client sends could be hostile. Treating all input as untrusted is the mindset that prevents most attacks.

Injection happens when user input is treated as code or a command. The attacker smuggles instructions into a query or shell.

Pasting input straight into SQL is the classic mistake. A crafted value can rewrite your query and dump the whole table.

The fix is to pass values as parameters, never string concatenation. The driver then escapes them safely for you.

With SQLAlchemy you use filter_by and bound values, so queries are parameterized by default and injection is far harder.

Check that input matches what you expect before using it. Confirm the type and range so a string never sneaks in where a number belongs.

Listing the few values you accept beats chasing every bad one. An allowlist rejects anything you did not explicitly permit.

A schema library like Marshmallow checks fields for you. It raises a ValidationError when a payload is the wrong shape.

Injection also lands in HTML. Jinja2 autoescaping turns user text into safe characters so scripts cannot run on the page.

Marking content with the safe filter disables escaping. Only do it for text you fully trust, never raw user input.

Validate the moment data arrives, before it touches your logic. Failing fast with a 400 keeps bad input from spreading.

Choose the technique that stops SQL injection.

You learned to distrust input, stop SQL injection with parameterized queries, validate with schemas, allowlist values, and escape output. Solid security work!